Third parties that process data on Attendae's behalf
When Attendae acts as a Data Processor on behalf of an institution (the Data Controller), any third party that Attendae engages to help process personal data on that institution's behalf is called a sub-processor.
Attendae only engages sub-processors that provide sufficient guarantees regarding technical and organizational security measures, and binds them to data processing obligations at least as protective as those in Attendae's own DPA.
This list is provided in the interest of transparency. For the purposes of Mexico's LFPDPPP (Federal Law on Protection of Personal Data Held by Private Parties), disclosure of transfers to third parties — including sub-processors — is required in our privacy notices.
| Provider | Service | Data processed | Purpose |
|---|---|---|---|
| Banahosting Mexico | Web hosting & infrastructure | All data stored on the Attendae platform: institutional data, participant lists, attendance records, certificates, uploaded files | Hosting the platform servers and databases on managed infrastructure in Mexico |
| Stripe, Inc. United States | Payment processing | Name, email, billing address, and payment card details of the person completing the purchase. Attendae does not store card numbers. | Processing payments for plans and folio packs. Stripe handles all PCI-DSS cardholder data; Attendae only receives confirmation of payment success. |
Attendae does not use Google Analytics, Facebook Pixel, Hotjar, HubSpot, Intercom, or any other analytics, behavioral tracking, or advertising platform. Institutional and participant data is never shared with advertising networks.
We want to be explicit: Attendae does not share any personal data with analytics services, advertising networks, social media platforms, or data brokers — now or in the past. Our business model is based on subscription and per-folio fees, not on monetizing user data.
The sub-processor list above is complete. If it shows only Banahosting and Stripe, that is the entire picture.
Banahosting is a Mexican company and all primary data storage occurs in Mexico.
Stripe is a US-based company. When you make a payment on Attendae, your payment information is transferred to Stripe's infrastructure in the United States. Stripe participates in applicable cross-border data transfer frameworks and maintains PCI-DSS Level 1 certification for payment data security.
Your participation records, attendance data, and certificates are stored exclusively in Mexico on Banahosting infrastructure. Only payment transaction data touches US-based infrastructure (Stripe), and only during the payment process.
Under the LFPDPPP, international transfers of personal data must be disclosed in the Privacy Notice. Both transfers described above are covered in Attendae's Privacy Policy.
If Attendae engages a new sub-processor, or an existing sub-processor is replaced or removed, this page will be updated to reflect the change.
Institutions that have signed a DPA with Attendae will be notified of new sub-processors at least 30 days in advance, giving them the opportunity to raise objections if a new sub-processor is incompatible with their own data protection obligations. Objections must be submitted in writing to privacidad@attendae.com.
This page was last updated in 2025.